Google Chrome CVE-2026-79176

Exploitation requires a user running Google Chrome prior to version 152.0.7977.65 on a desktop platform to be socially engineered into installing a specifically crafted extension. The CVSS UI:R metric confirms mandatory user interaction - the attack cannot succeed without the user's deliberate installation action. The attacker requires no authenticated access to any target system (PR:N). Exploitation is limited by the need to successfully deceive the user, which may be thwarted by Chrome's extension install warnings, enterprise extension policies, or user vigilance. The vulnerability does not affect server-side infrastructure and is not exploitable without the extension installation step.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5, reflecting a network-accessible, low-complexity attack requiring no authentication but mandatory user interaction, with high confidentiality impact and no integrity or availability impact. The EPSS score of 0.25% (16th percentile) is notably low, indicating real-world exploitation is not currently widespread relative to other CVEs despite the potentially broad user base. This is a social-engineering-dependent vulnerability: real-world risk is bounded by the attacker's ability to convince users to install a malicious extension, which is a non-trivial obstacle. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified. The overall risk profile is moderate: the attack surface is ubiquitous (Chrome is installed nearly everywhere), but the required user interaction and social engineering dependency mean that even a well-staffed IT team should treat this as a routine patch-cycle priority rather than an emergency. SSVC signals support a lower urgency classification: exploitation status is none confirmed, technical impact is partial (confidentiality only), and automatable exploitation is constrained by the UI:R requirement.

An attacker creates a Chrome extension that manipulates its displayed name, icon, or permission descriptions to impersonate a trusted extension or appear benign, then distributes it via a phishing page, sideloading link, or a fraudulent Chrome Web Store listing. A user on a pre-152.0.7977.65 Chrome instance is deceived by the misrepresented UI into installing the extension. Once installed, the extension captures sensitive data such as login credentials, session tokens, or form inputs and exfiltrates them to an attacker-controlled endpoint.